Comments on: ASLR: Address Space Layout Randomization https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Thu, 07 May 2026 00:47:28 +0000 http://wordpress.org/?v=2.3.3 By: Crash Dump Analysis » Blog Archive » Exception Addresses from Event Logs https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-76518 Crash Dump Analysis » Blog Archive » Exception Addresses from Event Logs Thu, 28 May 2009 10:26:35 +0000 https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-76518 [...] on Vista and W2K8 due to ASLR system DLLs could be at different addresses if we take the dump of a different running process [...] […] on Vista and W2K8 due to ASLR system DLLs could be at different addresses if we take the dump of a different running process […]

]]> By: Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 10a) https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-26229 Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 10a) Wed, 07 May 2008 13:05:29 +0000 https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-26229 [...] similar address space reshuffling happens with ASLR-enabled applications with the difference that system DLLs are never remapped below [...] […] similar address space reshuffling happens with ASLR-enabled applications with the difference that system DLLs are never remapped below […]

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-2795 Dmitry Vostokov Mon, 02 Jul 2007 18:03:01 +0000 https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-2795 Thanks for pointing to this! I have corrected the text. Thanks for pointing to this! I have corrected the text.

]]> By: Nicolas RUFF https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-2790 Nicolas RUFF Mon, 02 Jul 2007 05:48:06 +0000 https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-2790 Indeed, but this is not consistent with the introduction: "* Load address randomization (/dynamicbase linker option) * Stack address randomization (/dynamicbase linker option) * Heap randomization The first two randomizations change addresses across Vista reboots." Indeed, but this is not consistent with the introduction:

“* Load address randomization (/dynamicbase linker option)
* Stack address randomization (/dynamicbase linker option)
* Heap randomization
The first two randomizations change addresses across Vista reboots.”

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-2688 Dmitry Vostokov Thu, 28 Jun 2007 00:35:28 +0000 https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-2688 Agree, this is what my table says (both +): <pre><code>Randomization | New/Reboot | New | Old/Reboot | Old ------------------------------------------------------ Stack | + | + | - | - ------------------------------------------------------ </code></pre> Thanks, Dmitry Agree, this is what my table says (both +):

Randomization   | New/Reboot | New | Old/Reboot | Old
------------------------------------------------------
Stack           |      +     |  +  |      -	|  -
------------------------------------------------------

Thanks,
Dmitry

]]> By: Nicolas RUFF https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-2683 Nicolas RUFF Wed, 27 Jun 2007 19:19:28 +0000 https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-2683 Stack address changes on every program execution, not on reboot. I have just been testing on my Vista32 with this 1-liner: int main() { int i; printf("%08x", &i); } Stack address changes on every program execution, not on reboot. I have just been testing on my Vista32 with this 1-liner:

int main() {
int i;
printf(”%08x”, &i);
}

]]> By: Dmitry Vostokov https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-1997 Dmitry Vostokov Fri, 25 May 2007 08:32:29 +0000 https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-1997 <p>I haven't installed x64 Vista yet but it looks like it has been added:</p> <p><a href="http://www.windowsitpro.com/Windows/Article/ArticleID/50522/50522.html" rel="nofollow">What You Need to Know About Windows Vista x64 Versions' Unique Security Features</a></p> <p><a href="http://www.winsupersite.com/showcase/winvista_ff_x64.asp" rel="nofollow">Windows Vista Feature Focus: 64-Bit (x64) Support</a></p> <p>and there is some indirect evidence that Vista x64 supports ASLR on MS web site:</p> <p>http://support.microsoft.com/kb/922822/</p> I haven’t installed x64 Vista yet but it looks like it has been added:

What You Need to Know About Windows Vista x64 Versions’ Unique Security Features

Windows Vista Feature Focus: 64-Bit (x64) Support

and there is some indirect evidence that Vista x64 supports ASLR on MS web site:

http://support.microsoft.com/kb/922822/

]]> By: Pirks https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-1994 Pirks Fri, 25 May 2007 03:20:04 +0000 https://www.dumpanalysis.org/blog/index.php/2007/05/22/aslr-address-space-layout-randomization/#comment-1994 Dmitry, is this ASLR feature a Vista x64 specific one? Or is it available in both 32-bit and 64-bit Vista? Dmitry, is this ASLR feature a Vista x64 specific one? Or is it available in both 32-bit and 64-bit Vista?

]]>